System and method of in-place content management

The application claims priority and the benefit of U.S. Provisional Patent Application Ser. No. 63/365,423, entitled “SYSTEM AND METHOD OF IN-PLACE CONTENT MANAGEMENT”, filed on May 27, 2022 and international PCT application PCT/CA2023/050731, entitled “SYSTEM AND METHOD OF IN-PLACE CONTENT MANAGEMENT”, filed on May 28, 2023, the disclosure of which is incorporated herein by reference in its entirety.

This disclosure relates to computer systems and, more specifically, to local (on premises) file storage and access.

New Technology File System (NTFS) file systems (file shares) are often used to store files and other data for access by users of an organization's computers.

Since the start of the digital revolution, organizations have been creating digital content at an accelerating pace without considering how to find, manage and action all these unstructured documents. At a mid-sized company, this can amount to hundreds of terabytes (TB) of data which corresponds to the creation of hundreds of millions of documents. At a large-sized company this can amount to petabytes (PB) of data (each petabyte corresponds to about a billion documents). When these companies wish to get their file system documents “under management”, their only historical option has been to migrate these documents into a proprietary enterprise content management (ECM) solution such as OpenText's Content Server or Microsoft's SharePoint Online.

The problem with this approach is three-fold. First, migrating data takes a lot of time. Migrations of smaller amounts (i.e., a few terabytes) of data can take a few months, while migrating a lot of data may take years. Organizations may not be willing to wait that long for such migrations to complete.

Second, ECM solutions may have upper limits as to how much data they can realistically hold. For example, the Open Text Content Server may have a limit of 300 terabytes of data. If an organization has data stores measured in petabytes (PB), there is no ECM that can realistically hold that much data.

Third, ECM solutions often result in an end-user experience that is worse than it was before the data was moved into the new ECM. Finding and/or accessing documents becomes more difficult and, in general, is much slower. For example, editing a document in a cloud-based system is typically much slower than editing one that is on a local file system.

Companies who wish to get all of their file system documents “under management” by migrating it into an ECM solution may not even have a complete solution for all of their data. A typical pitfall for an organization implementing a migration to an ECM solution occurs in the process of moving data from their original storage location(s) to the new destination location. Since migrating large volumes of data takes time to not only move, but also validate the outcome, this approach introduces new risks to the reliability and availability of those data assets.

An organization may attempt to soften the impact of the data movement by iteratively selecting subsets of data to move at one time, but this also introduces instability into the data system as it is difficult to have assurance that the location of important data is known at all times. In addition, the process to select batches of data to move may overlook important records and sever dependencies between different data stores, ultimately increasing the probability of losing important information.

Furthermore, businesses and companies are required to understand all their data, even though it may be scattered across multiple repositories and growing at an exponential rate. Additionally, businesses are worried about risks relating to cyber-threats, security breaches and managing data loss prevention.

What is desired is a tool or utility that allows or maintains easy access to data, while providing the functionality of an enterprise content management (ECM) system, without the requirement to export any data from their existing file system(s).

A system and method of an in-place content management system that allows an organization to bring the power of an enterprise content management (ECM) system (supporting such features as check-out, check-in, security, audit, add, rename, move, delete, classification, legal holds and disposition) to the data where it resides on an NTFS file system, eliminating the need to move it somewhere else and without having to change the way end-users work. A utility or tool for content management that leverages the existing security that is already in place on files and folders and adds basic content management features such as check-out/check-in (preventing multiple users from editing the same document at the same time), audit history, and the ability to add classifications, trigger dispositions, and apply legal holds on documents where they currently reside.

According to this disclosure, a software-based utility or tool for content management which may be involved in document intelligence, including organizing enterprise information and making it actionable and understood. Further, the utility or tool should also be concerned with data governance and information security.

According to this disclosure, a software-based utility or tool for content management which should provide auto-classification of data at machine speed, using artificial intelligence to bring documents into compliance, and ensure the right information gets to the right people at the right time.

According to this disclosure, a tool or utility such as Shinydocs Cognitive Suite will be extended to provide Enterprise Content Management (ECM) value in-place on Shared drives. Using existing connectors, the platform will be extended to apply artificial intelligence (AI)/machine learning (ML) technology to control content permissions and access, legal holds, attribution, classification, and disposal.

Objectives:

One objective of a content management system is to provide de-facto tools and strategy for Enterprise Content that scales to the modern volumes of content data and eliminates human intervention on mundane content and tasks.

To achieve this objective, modern content management system tools provide Content Understanding using machine learning (ML), artificial learning (Al), and massively scalable search to rapidly understand, find, manage, and action these data; increase worker productivity; automate simple content tasks; and action content which results in decreased costs and liability.

According to the disclosure, the objectives of this tool or utility include providing enterprise value including discovery, legal holds, content prioritization, and disposition across all enterprise content and data contained in the enterprise content management system.

snapshotting a network drive's contents, locking down a network drive's contents, restoring removed permissions to their previous state for given files on a network drive that has had a snapshot taken. According to the disclosure, a further objective is to develop the functionality to save, remove access and restore access based on a “state in time” for a network drive. This includes the following:

check-out files, check-in files. According to the disclosure, a further objective is to develop the functionality to provide basic document management on a network drive. This includes the following capabilities:

According to the disclosure, a further objective is to enhance the basic document management on a network drive with support for inherent file features, such as file move, file rename and file copy. This will be implemented for a given user with appropriate permissions (as confirmed by checking our “shadow copy” permissions) before the permissions were removed.

legal holds, disposition, classification. According to the disclosure, a further objective is to enhance the improved document management features with content management features. This includes the following functions:

First, scan the selected file system, making a “shadow copy” of the existing permissions on all files and folders in the file system. When this is done, load the entire folder structure into a database so there is a record of the structure and the metadata associated with all files and folders. Next, file system permissions are changed so that everything but read-access is removed from all files and folders in the selected file system. Access permissions at the user level are not changed: any user who had the ability to read the file or folder previously still has this ability—and any users who did not have any read access previously do not gain this as a result). The underlying cornerstone of this disclosure is to leverage the power of New Technology File System (NTFS) permissions for controlling access to documents (i.e., files) themselves in concert with a companion application for higher level content management functionality. The approach is the following:

From this point forward, end-users gain access to files and folders via a Windows File Explorer add-in that enables the ability to “check-out” documents, temporarily restricting document edit access to a single user, and “check-in” the same documents, restoring edit access once the user is done. The action of editing a document once it has been checked-out is performed in the same manner as users are accustomed to (i.e., double-click on the document to open it in the associated editing tool), thereby requiring no need to change the way users work with documents. Other file system actions such as add, rename, move, and delete are also available, but remain only valid for a given user possessing the requisite permissions (as confirmed by checking the “shadow copy” permissions) before the permissions were removed. Any of these actions that are taken are audited and stored in a database that is administered by a central IIS server.

To provide additional content management features, as would be found in a full ECM, authorized end-users are able to assign a Classification value to a document, assign a Hold to a document, and assign a Disposition value to a document. Each of these are governed by user groups that are managed by the IIS server and synchronized with Microsoft Active Directory. All of these actions are audited and stored in a database that is administered by the central on-premises server. As a result, any audited actions that have been taken on a given file or folder can be viewed via the Windows File Explorer add-in, in accord with view permissions assigned to that user.

The features described earlier (check-out, check-in, audit, add, rename, move, delete, add classification, add hold, add disposition) are ones that would commonly be found in an ECM, however these features would now be available on files and folders in the NTFS file system, without the need to move data anywhere. This therefore provides an organization the ability to get its file system documents “under management”, by leaving them in place where they are, regardless of the total amount of data, while maintaining the same fast speeds users are already accustomed to on their existing file system.

The server/database side of the design is such that multiple databases can be added dynamically to the system, achieving load balancing and load sharing as a result. This is important when the product is implemented at sites that have multiple databases and data stores measuring in PBs—this solution will work in such an environment.

The “shadow copy” of permissions leverages the caching of file/folder permissions via a copy of the file system that is produced, with exact copies of Windows permissions, as zero-byte files to keep the size small. This is necessary due to the complexity of Windows permissions themselves, as it was found that translating this into a database field was enormously complicated, if not impossible, to duplicate outside of the Windows OS.

Permissions removed when the initial “shadow copy” is made can be restored with the use of a tool that will effectively reinstate the “snapshot” of the permissions on the file system, if an organization wants to back out this change.

Changes to the file system access permissions has an additional benefit against the common ransomware tactic of deceiving a user into granting common Windows access to a program since administrative permissions on all files they can access is effectively removed. Such attacks are no longer possible since all such permission adjustments for end-users has been replaced by the Shinydocs In-Place Content Management system, thereby improving file system security.

1 FIG. 10 10 12 14 16 shows a typical networked computer systemaccording to the present invention. The systemincludes at least one user computer deviceand at least one serverconnected by a network.

12 12 The user computer devicecan be any computing device, such as a desktop or notebook computer, a smartphone, tablet computer, and the like. The user computer devicemay be referred to as a computer.

14 14 The serveris a device such as a mainframe computer, blade server, rack server, cloud server, or the like. The servermay be operated by a company, government, or other organization, and may be referred to as an enterprise server or an enterprise content management (ECM) system.

16 16 12 14 The networkcan include any combination of wired and/or wireless networks, such as a private network, a public network, the Internet, an intranet, a mobile operator's network, a local-area network, a virtual-private network (VPN), and similar. The networkoperates to communicatively couple the computer deviceand the server.

12 14 16 14 12 In a contemplated implementation, a multitude of computer devicesconnect to several serversvia an organization's internal network. In such a scenario, the serversstore documents and other content in a manner that allows collaboration between users of the computer devices, while controlling access to and retention of the content. Such an implementation allows large, and often geographically diverse, organizations to function. Document versioning and/or retention may be required by some organizations to meet legal or other requirements.

10 18 16 12 18 14 The systemmay further include one or more support serversconnected to the networkto provide support services to the user computer device. Examples of support services include storage of configuration files, authentication, and similar. The support servercan be within a domain controlled by the organization that controls the serversor it can be controlled by a different entity.

12 20 22 24 26 28 The computer deviceexecutes a file manager, a local-storage file system driver, a local storage device, a remote-storage file system driver, and a content management system interface.

20 20 30 12 24 20 32 12 32 30 32 30 20 30 The file manageris configured for receiving user file commands from a user interface (e.g., mouse, keyboard, touch screen, etc.) and outputting user file information via the user interface (e.g., display). The file managermay include a graphical user interface (GUI)to allow a user of the computerto navigate and manipulate hierarchies of folders and files, such as those residing on the local storage device. Examples of such include Windows Explorer and Mac OS Finder. The file managermay further include an application programming interface (API) exposed to one or more applicationsexecuted on the computerto allow such applicationsto issue commands to read and write files and folders. Generally, user file commands include any user action (e.g., user saves a document) or automatic action (e.g., application's auto-save feature) performed via the file manager GUIor applicationthat results in access to a file. The file manager GUIand API may be provided by separate programs or processes. For the purposes of this disclosure, the file managercan be considered to be one or more processes and/or programs that provide one or both of the file manager GUIand the API.

22 12 24 22 24 22 24 The local-storage file system driveris resident on the computerand provides access to the local storage device. The file system driverresponds to user file commands, such as create, open, read, write, and close, to perform such actions on files and folders stored on the local storage device. The file system drivermay further provide information about files and folders stored on the local storage devicein response to requests for such information.

24 The local storage devicecan include one or more devices such as magnetic hard disk drive, optical drives, solid-state memory (e.g., flash memory), and similar.

26 20 28 26 28 20 26 28 26 20 20 The remote-storage file system driveris coupled to the file managerand is further coupled to the content management system interface. The file system drivermaps the content management system interfaceas a local drive for access by the file manager. For example, the file system drivermay assign a drive letter (e.g., “H:”) or mount point (e.g., “/Enterprise”) to the content management system interface. The file system driveris configured to receive user file commands from the file managerand output user file information to the file manager. Examples of user file commands include create, open, read, write, and close, and examples of file information include file content, attributes, metadata, and permissions.

26 26 28 The remote-storage file system drivercan be based on a user-mode file system driver. The remote-storage file system drivercan be configured to delegate callback commands to the content management system interface. The callback commands can include file system commands such as Open, Close, Cleanup, CreateDirectory, OpenDirectory, Read, Write, Flush, GetFileInformation, GetAttributes, FindFiles, SetEndOfFile, SetAttributes, GetFileTime, SetFileTime, LockFile, UnLockFile, GetDiskFreeSpace, GetFileSecurity, and SetFileSecurity.

28 12 14 28 16 40 14 28 26 40 The content management system interfaceis the interface between the computerand the enterprise server. The content management system interfaceconnects, via the network, to a content management systemhosted on the enterprise server. As will be discussed later in this document, the content management system interfacecan be configured to translate user commands received from the driverinto content management commands for the remote content management system.

28 20 26 40 28 40 20 26 The content management system interfaceis a user-mode application that is configured to receive user file commands from the file manager, via the driver, and translate the user file commands into content management commands for sending to the remote content management system. The content management system interfaceis further configured to receive remote file information from the remote content management systemand to translate the remote file information into user file information for providing to the file managervia the driver.

40 43 28 28 40 41 42 44 46 48 42 44 46 48 The remote content management systemcan be configured to expose an APIto the content management system interfacein order to exchange commands, content, and other information with the content management system interface. The remote content management systemstores directory structurescontaining files in the form of file content, attributes, metadata, and permissions. File contentmay include information according to one or more file formats (e.g., “.docx”, “.txt”, “.dxf”, etc.), executable instructions (e.g., an “.exe” file), or similar. File attributescan include settings such as hidden, read-only, and similar. Metadatacan include information such as author, date created, date modified, tags, file size, and similar. Permissionscan associate user or group identities to specific commands permitted (or restricted) for specific files, such as read, write, delete, and similar.

40 49 41 42 44 46 48 16 The remote content management systemcan further include a web presentation moduleconfigured to output one or more web pages for accessing and modifying directory structures, file content, attributes, metadata, and permissions. Such web pages may be accessible using a computer's web browser via the network.

28 The content management system interfaceprovides functionality that can be implemented as one or more programs or other executable elements. The functionality will be described in terms of distinct elements, but this is not to be taken as limiting or exhaustive. In specific instances not all of the functionality needs to be implemented.

28 52 28 40 14 18 12 28 The content management system interfaceincludes an authentication componentthat is configured to prompt a user to provide credentials for access to the content management system interface, and for access to the remote content management system. Authentication may be implemented as a username and password combination, a certificate, or similar, and may include querying the enterprise serveror the support server. Once the user of the computer deviceis authenticated, he or she may access the other functionality of the content management system interface.

28 54 12 14 28 54 40 20 20 40 The content management system interfaceincludes control logicconfigured to transfer file content between the computerand the server, apply filename masks, evaluate file permissions and restrict access to files, modify file attributes and metadata, and control the general operation of the content management system interface. The control logicfurther effects mapping of remote paths located at the remote content management systemto local paths presentable at the file manager. Path mapping permits the user to select a file via the file managerand have file information and/or content delivered from the remote content management system. In one example, the remote files and directories are based on a root path of “hostname/directory/subdirectory” that is mapped to a local drive letter or mount point and directory (e.g., “H:/hostname/directory/subdirectory”).

28 56 12 40 40 40 40 The content management system interfaceincludes filename masksthat discriminate between files that are to remain local to the computerand files that are to be transferred to the remote content management system. Temporary files may remain local, while master files that are based on such temporary files may be sent to the remote content management system. This advantageously prevents the transmission of temporary files to the remote content management system, thereby saving network bandwidth and avoiding data integrity issues (e.g., uncertainty and clutter) at the remote content management system.

28 58 12 32 The content management system interfaceincludes a cacheof temporary files, which may include working versions of files undergoing editing at the user computer deviceor temporary files generated during a save or other operating of an application.

28 59 58 59 52 58 58 28 56 59 The content management system interfaceincludes an encryption engineconfigured to encrypt at least the cache. The encryption enginecan be controlled by the authentication component, such that a log-out or time out triggers encryption of the cacheand successful authentication triggers decryption of the cache. Other informational components of the content management system interfacemay be encrypted as well, such as the filename masks. The encryption enginemay conform to an Advanced Encryption Standard (AES) or similar.

2 FIG. 12 12 60 62 64 66 68 60 62 64 66 68 shows an example of a user computer device. The computer deviceincludes a processor, memory, a network interface, a display, and an input device. The processor, memory, network interface, display, and input deviceare electrically interconnected and can be physically contained within a housing or frame.

60 62 64 60 60 The processoris configured to execute instructions, which may originate from the memoryor the network interface. The processormay be known a CPU. The processorcan include one or more processors or processing cores.

62 62 62 62 The memoryincludes a non-transitory computer-readable medium that is configured to store programs and data. The memorycan include one or more short-term or long-term storage devices, such as a solid-state memory chip (e.g., DRAM, ROM, non-volatile flash memory), a hard drive, an optical storage disc, and similar. The memorycan include fixed components that are not physically removable from the client computer (e.g., fixed hard drives) as well as removable components (e.g., removable memory cards). The memoryallows for random access, in that programs and data may be both read and written.

64 12 16 64 1 FIG. The network interfaceis configured to allow the user computer deviceto communicate with the network(). The network interfacecan include one or more of a wired and wireless network adaptor and well as a software or firmware driver for controlling such adaptor.

66 68 The displayand input deviceform a user interface that may collectively include a monitor, a screen, a keyboard, keypad, mouse, touch-sensitive element of a touch-screen display, or similar device.

62 20 26 28 12 20 26 28 12 16 20 1 FIG. The memorystores the file manager, the file system driver, and the content management system interface, as well as other components discussed with respect to. Various components or portions thereof may be stored remotely, such as at a server. However, for purposes of this description, the various components are locally stored at the computer device. Specifically, it may be advantageous to store and execute the file manager, the file system driver, and the content management system interfaceat the user computer device, in that a user may work offline when not connected to the network. In addition, reduced latency may be achieved. Moreover, the user may benefit from the familiar user experience of the local file manager, as opposed to a remote interface or an interface that attempts to mimic a file manager.

Architecture

3 FIG. 3 FIG. 302 is a diagram of an exemplary architecture of an in-place content management system. According to, this diagram illustrates the “Before” and “After” architecture for an end-user. Initially, an end-user would use Windows File Explorerto access their file system.

300 314 312 316 318 320 322 324 326 328 330 332 334 300 336 338 340 3 FIG. The After scenario is with an In-Place Content Management systemimplemented. According to, in the After scenario, there will be an In-Place menu that users will have access to via a Right-Click menu(if on Windows File Explorer), or a Web experience (if interacting via a Web browser), or a Microsoft Office Add-In(if using any of the Microsoft Office applications, such as Word, Excel, PowerPoint or Visio), or via an application if on a mobile device(such as iOS or Android). By using any of these interfaces, users will have access to summaries of metadata, categories and attributesor insights, as well as audit, versions, disposition, and permission information. Furthermore, the In-Place Content Management systemwill impact the Filesystem, Active Directory structureand Database.

Database Schema

4 FIG. is a diagram of an exemplary database schema of an in-place content management system. This is an entity relationship diagram for the database schema that supports In-Place Content Management.

4 FIG. 400 402 Disposition 404 DispositionObject 406 FileSystemPermission. 408 HoldObject 410 Hold. 412 FileSystemCheckout 414 FileSystemObject 416 JobError 418 Event 420 SourceDrive. 422 FilfeSystemMetadata 424 JobGUI Snapshot According to, the database schemamay include the following tables:

5 FIG. 5 FIG. 500 502 is a screenshot illustrating an exemplary graphical user interface of an in-place content management system. According to, the In-Place Content Management exampleis via a Windows File Explorer add-in. To launch the application, if an end-user has the In-Place Content Management Windows Explorer add-in installed, by simply navigating to a folder that has been added to In-Place Content Management, the “Shiny In-Place” menuwill appear in the right-click menu. If displayed, simply click on this item to continue.

Check-Out Snapshot

6 FIG. 6 FIG. 600 is a screenshot illustrating Check-Out file feature. According to, the general concept of screenshotincludes a File Share that has In-Place Content Management on it-all content (including the file clicked on) is prevented from modification (editing), until a given user (with sufficient permissions before it was placed under management) checks it out.

Before the user can edit a document, they simply select Check Out the file via the “In-Place” menu, then they can edit it normally. Once checked out, one can interface with the document as normal (editing with a file editing application (e.g., Microsoft Word, Excel, PowerPoint, etc.) on their Windows machine). Once completed, selecting the Check In option will once again place the document under management. Also, if one happens to view the In-Place menu for a document that is checked out by someone else, one will see their name beside Checked Out By in the In-Place menu.

Add New Document Snapshots

7 7 FIGS.A andB 7 FIG.A 702 702 702 are screenshots illustrating Adding a New Document. According to, the normal way to add documents is to navigate up to the containing Folder in the screenshotand once there, select Addfrom the In-Place menu, which will in turn display the In-Place Add Window.

7 FIG.B 710 712 According to, once this screenshotappears, simply drag and drop files or folders from somewhere else (i.e., from the desktop or another file system) into the Share. A confirmation message such as “Successfully added content!” will appear after the upload is complete.

Renaming Snapshots

8 8 FIGS.A andB 8 FIG.A 8 FIG.B 800 802 810 812 are screenshots illustrating Renaming actions. Renaming actions includes renaming a file or folder or moving or deleting a file or folder. According to screenshotin, to rename a file or folder, select “Rename”from the In-Place menu, which will in turn display the In-Place Rename Window. Once the user sees this Window, click on the New Name field, change the name of the file or folder as you like and click “Save” when done, which is illustrated inin screenshot. The functions of Move and Delete behave in similar fashion to Rename.

Classifications Snapshots

9 9 FIGS.A andB 9 FIG.A 902 900 are screenshots illustrating Classifications actions. Only users who are allowed to apply Classifications to a document will see this option. When clicked on, this will display the In-Place Classifications menu, from which one can then select one of the available drop-down values, as shown inin screenshot.

910 912 9 FIG.B Once the user selects “Save”, the view is updated to show the selection, as shown in screenshotin. From then on, whenever any user selects “Classifications”(from the menu) for this document, they will see the classification value(s) that were assigned to it-regardless of who assigned them.

Dispositions Snapshots

10 10 FIGS.A andB 10 FIG.A 1000 1002 are screenshots illustrating Dispositions actions. Only users who are allowed to assign Dispositions to a document will see this option. According to screenshotin, when clicked on, this will display the In-Place “Dispositions” menu, from which one can then select one of the available drop-down values.

1010 1012 10 FIG.B Once a selection is saved, the view is updated to show that selection, as shown in screenshotin. From then on, whenever any user selects “Dispositions”for this document, they will see the disposition value(s) that were assigned to it-regardless of who assigned them. Multiple Dispositions can be assigned to a given document.

Holds Snapshots

11 11 FIGS.A andC 11 FIG.A 1100 1102 are screenshots illustrating Holds actions. Only users who are allowed to apply Holds to a document will see this option. According to screenshotin, when clicked on, this will display the In-Place “Holds” menu, from which one can then select one of the available drop-down values.

1110 1112 11 FIG.B According to screenshotin, once a selection is Saved, the view is updated to show the selection. From then on, whenever any user selects “Holds”for this document (or other documents), they will see the hold value(s) that were assigned to it-regardless of who assigned them. Multiple Holds can be assigned to a given document.

1120 11 FIG.C Note that once a Hold is applied to a given document, that Hold may not be removed—an Administrator would need to take that action. Furthermore, once a document has a Hold placed in it, it may no longer be checked out, renamed, moved or deleted (i.e., it is locked from further editing). This can be seen by those options being removed from the In-Place Content Management menu, as shown in screenshotin.

Audit Trail Snapshot

12 FIG. 12 FIG. 12 FIG. 1200 1202 One of the advantages of the In-Place Content Management product is that there is an audit trail recorded for all significant actions taken on a given document.is a screenshot illustrating Audit Trail actions. According to screenshotof, to see the audit trail, click on Historywhich will show the In-Place History page for this document. According to, each entry has a date/time stamp, the user that performed the action, the action they took and any additional relevant detail, if applicable.

Further Snapshots

According to this disclosure and future embodiments, the following scenarios or snapshots are also envisioned.

Snapshot1: Snapshot a Network Drive

An Administrator is able to crawl the contents on a given network drive, storing the drive metadata in a database, Permissions information (users and groups) for each file and folder crawled are stored on a network drive in a “shadow copy” which consists of an exact copy of the drive structure and permissions, but with all zero-byte files, An Administrator is able to easily identify errors encountered during a network drive crawl in order to rectify the error(s), A reviewable audit will exist that can be used to verify which drives, folders, or files were crawled by whom and when, An Administrator is able to verify that the In-Place database (for a given network drive) matches what is on a given network drive at a point in time, The In-Place database will be secure and unable to be modified without proper levels of authorization, An Administrator is able to view a summary of what is in the In-Place database (for a given network drive) via a graphical user interface, An Administrator is able to record a set of any number of network drives and authentications for those drives for authentication/crawling, An Administrator is able to view a summary of what is in the In-Place database, by selecting a given network drive, or sets of drives, or all drives via a graphical user interface.Snapshot 2: Lock Down a Network Drive According to the disclosure, a snapshot of a network drive may include the following:

Authenticate as a user with heightened authorization against a given network drive for the purpose of adjusting file and folder permissions, A heightened authorized Administrator is able to automatically reduce the permissions on a given network drive for each folder and file, removing all but the ability to read, Before any permissions are reduced on any file or folder, that the In-Place “shadow copy” permissions matches what is on the network drive files/folders will be verified, The process by which permissions are reduced will be re-startable, skipping items already done, An Administrator is able to easily identify errors encountered during reducing permissions on a network drive in order to rectify the error(s), A reviewable audit will exist that can be used to verify which drives, folders, or files had permissions reduced by whom and when, An Administrator is able to view an enhanced summary (which objects had permissions reduced) of what is in the In-Place database (for a given network drive) via a graphical user interface, An Administrator is able to view an enhanced summary (which objects had permissions reduced) of what is in the In-Place database, by given network drive, or for sets of drives, or for all drives via a graphical user interface.Snapshot 3: Restore Permissions on a Network Drive According to the disclosure, a snapshot of a lock down of a network drive may include the following:

Ability for an Administrator to run as an elevated user to restore the permissions on a given network drive file to what they were before the permissions were reduced, Before any permissions are restored on any file, that the In-Place database (for a given network drive) matches what is on the network drive for that file will be verified, That the file permissions that were restored will be as per those stored in the network drive “shadow copy” for that object, An Administrator is able to easily identify errors encountered during restoring file permissions on a network drive in order to rectify the error(s), A reviewable audit will exist that can be used to verify which drive and files had permissions restored by whom and when, An Administrator is able to view an enhanced summary (which file had permissions restored) of what is in the In-Place database (for a given network drive) via a graphical user interface, The process by which permissions are restored for a set of files will be re-startable, skipping items already done, An Administrator is able to view an enhanced summary (which files had permissions restored) of what is in the In-Place database, by a given network drive, or for sets of drives, or for all drives via a graphical user interface An Administrator is able to view an enhanced summary (which files had permissions restored) of what is in the In-Place database, by a given network drive, or for sets of drives, or for all drives via a graphical user interface, A heightened authorized Administrator is able to use the In-Place database and the network drive “shadow copy” (for a given network drive) to restore the permissions on a given network drive folder (including all contained folders and files) to what they were before the permissions were reduced, Before any permissions are restored on any folder, that the In-Place database (for a given network drive) metadata matches what is on the network drive folder (including all contained folders and files) will be verified, That the folder (including all contained folders and files) permissions were restored will be recorded in the In-Place database (for a given network drive) for those objects, An Administrator is able to easily identify errors encountered during restoring folder (including all contained folders and files) permissions on a network drive in order to rectify the error(s), A reviewable audit will exist that can be used to verify which drive and folder (including all contained folders and files) had permissions restored by whom and when, An Administrator is able to view an enhanced summary (which folder (including all contained folders and files) had permissions restored) of what is in the In-Place database (for a given network drive) via a graphical user interface, A heightened authorized Administrator is able to schedule the automated folder (including all contained folders and files) permission restore for a set of folders on network drives, The process by which permissions are restored for a set of folders (including all contained folders and files) will be re-startable, skipping items already done, An Administrator is able to view an enhanced summary (which folders, including all contained folders and files, had permissions restored) of what is in the In-Place database (for a given network drive), by given network drive, or sets of drives, or all drives via a graphical user interface.Snapshot 4: Check-Out and Check-In According to the disclosure, restoring a snapshot of permissions of a network drive may include the following:

A desktop user is able to “check-out” a given file that they can see on a locked-down network drive via an add-in for Windows File Explorer (or equivalent navigation method), A desktop user will not be able to “check-out” a given file if the file is already “checked-out” by another user, A desktop user will not be able to “check-out” a given file if they do not have such permissions on the file, A desktop user is able to “check-out” a given file either as themselves (default) or as a group that they are a member of (both of these as determined by Active Directory), which is recorded in the In-Place database (for that given file), A desktop user will be able to add a short text description (if desired) to go along with the “check-out” action via an add-in for Windows File Explorer (or equivalent navigation method) Upon completing the “check-out”, the file will automatically be marked as “checked-out” in the In-Place database (for that given file), Audit: A reviewable audit will exist that can be used to verify the current state of any file in the In-Place database (i.e., which are currently “checked-out”—as well as an audit history of any “check-outs” that were done-by whom and when), A desktop user is only able to “check-in” a given file that is in a “checked-out” state (by themselves or as a group they are a member of) in the In-Place database (for that given file) via an add-in for Windows File Explorer (or equivalent navigation method), Upon “check-in” a desktop user is able to update the short text description (if desired) to go along with the “check-in” action via an add-in for Windows File Explorer (or equivalent navigation method), Upon completing the “check-in”, the “checked-out” state on the file will be removed in the In-Place database (for that given file), Upon completing the “check-in”, permissions on the file in the network drive are restored to what was previously recorded in the In-Place “shadow copy” for that file (i.e. all but read permissions removed), Upon opening a given file in the Microsoft Office suite of Products (Word, Excel, PowerPoint and Visio), a desktop user is able to “check-out” the file on a locked-down network drive via an add-in for Microsoft Office, Upon opening a given file via Microsoft Office, a desktop user will not be able to “check-out” a given file if the file is already “checked-out” by another user, Upon opening a given file via Microsoft Office, a desktop user will not be able to “check-out” a given file if they do not have such permissions on the file, Upon opening a given file via Microsoft Office that they are not able to “check-out”, it will be opened in “read only” mode in Microsoft Office, Upon opening a given file via Microsoft Office, a desktop user is able to “check-out” a given file either as themselves (default) or as a group that they are a member of (both of these as determined by Active Directory), which is recorded in the In-Place database (for that given file), Upon opening a given file via Microsoft Office, a desktop user will be able to add a short text description (if desired) to go along with the “check-out” action via an add-in for Microsoft Office, Upon closing a given file in the Microsoft Office suite of Products (Word, Excel, PowerPoint and Visio), a desktop user is able to “check-in” the file that is in a “checked-out” state in the In-Place database (for that given file) via an add-in for Microsoft Office, Upon closing a given file via Microsoft Office, a desktop user is only able to ‘check-in” the file if it is “checked-out” by either themselves, or as a group that they are a member of (both of these as determined by Active Directory), Upon “check-in” via Microsoft Office, a desktop user is able to update the short text description (if desired) to go along with the “check-in” action via an add-in for Microsoft Office.Snapshot 5: Support Network Drive Inherent File Features for NTFS File Systems According to the disclosure, a snapshot of check-in and check-out feature may include the following:

A desktop user is able to add, rename, move, or delete any file if their original network drive permissions allowed these actions on the file(s) in question. For an “add”, via a Windows pop-up (or equivalent method), the desktop user will be able to select file(s) to add to the selected folder location. The In-Place database for the given file(s) will be updated to record the addition of these files. An actual add of the file(s) will be done on the network drive, as will an equivalent add of “shadow copies” of the file(s) on the “shadow copy” network drive. Permissions will be inherited from the containing folder. That the file(s) were added will be recorded in an audit entry showing by whom and when the add was done. For a “rename”, via a Windows pop-up (or equivalent method), the desktop user will be able to specify a new name for the selected file. If this new name is valid (e.g.: does not already exist in this folder for example), upon saving—the In-Place database (for the given file) will be updated to match the new value. The network drive will also be updated with the new file name, as will be the equivalent file entry in the “shadow copy” network drive. That the file was renamed will be recorded in an audit entry showing by whom and when the rename was done (and what the old and new values were). For a “move”, via a Windows pop-up (or equivalent method) the desktop user will be able to browse to and select a new location for the selected file. If this new location is valid (e.g.: a file with the same name does not already exist in the new location, for example), upon saving—the In-Place database (for the given file) will be updated to match the new location for the file. An actual move of the file will be done on the network drive, as will an equivalent move of the “shadow copy” of the file on the “shadow copy” network drive. That the file was moved will be recorded in an audit entry showing by whom and when the move was done (and what the old and new locations were). Note that a move operation of a file to a non-controlled network drive (or other storage) may or may not be supported via an Administrator setting to allow or disallow this. For a “delete”, via a Windows pop-up (or equivalent method) the desktop user will be able to confirm (or cancel) their intention to delete the selected file. If confirmed, the In-Place database (for the given file) will be updated to record the delete for the file. An actual delete of the file will be done on the network drive, as will an equivalent delete of the “shadow copy” of the file on the “shadow copy” network drive. That the file was deleted will be recorded in an audit entry showing by whom and when the delete was done.Snapshot 6: Classifications According to the disclosure, a snapshot of network drive inherent file features for NTFS file systems may include the following:

A network administrator is able to authorize a user or group to be able to “manage classifications”. A user that is able to manage classifications may create a new named “classification” via an Administration interface. Such a classification will have a name and a hierarchy (i.e. a given classification may have classifications beneath it-so the classification of “books” might have classifications beneath if of “fiction” and “non-fiction” for example). A user that is able to manage classifications may view all files or folders that have a given named “classification” placed on them via an Administration interface. A user that is able to manage classifications is able to assign a named classification on a given file (or folder) either as themselves (default) or as a group that they are a member of (both of these as determined by Active Directory), that they can see on a locked-down network drive via an add-in for Windows File Explorer (or equivalent navigation method). This assignment is recorded in the In-Place database (for the given file or folder (including all files in the folder)). A reviewable audit will exist that can be used to verify the current state of any file in the In-Place database (i.e. which are currently have one or more assigned classifications—as well as an audit history of any classifications that were placed—by whom and when). All users that have access to view a file or folder may also view the assigned classification or classifications via an add-in for Windows File Explorer (or equivalent navigation method). A user that is able to manage classifications is able to remove a named classification on a given file or folder (including all files in the folder) in the In-Place database via an add-in for Windows File Explorer (or equivalent navigation method)Snapshot 7: Dispositions According to the disclosure, a snapshot of classifications may include the following:

A network administrator is able to authorize a user or group to be able to “manage dispositions”. A user that is able to manage dispositions may create a new named “disposition” via an Administration interface. Such a disposition will have a name, description and a disposal date. Note that the disposal date may be today's date if desired (i.e., dispose of the file immediately). A user that is able to manage dispositions may view all files or folders that have a given named “disposition” placed on them via an Administration interface. A user that is able to manage dispositions is able to assign a named disposition on a given file (or folder) either as themselves (default) or as a group that they are a member of (both of these as determined by Active Directory), that they can see on a locked-down network drive via an add-in for Windows File Explorer (or equivalent navigation method). This assignment is recorded in the In-Place database (for the given file or folder (including all files in this folder)). A reviewable audit will exist that can be used to verify the current state of any file in the In-Place database (i.e. which are currently under “disposition”—as well as an audit history of any dispositions that were placed—by whom and when) A user that is able to manage dispositions is able to remove a named disposition on a given file or folder (including all files in the folder) in the In-Place database via an add-in for Windows File Explorer (or equivalent navigation method). An automated process will automatically delete any files tagged as “disposition” in the In-Place database (for a given network drive), once the “disposition date” has occurred. Note however that files that are “locked” will not be deleted. An actual delete of the file will be done on the network drive, as will an equivalent delete of the “shadow copy” of the file on the “shadow copy” network drive. An audit of this event will also be recorded in the In-Place database (for the given files)Snapshot 8: Holds According to the disclosure, a snapshot of dispositions may include the following:

A network administrator is able to authorize a user or group to be able to “manage holds”. A user that is able to manage holds may create a new named “hold” via an Administration interface. Such a hold will have a name, description and a review date. Note that the review date can be indefinite if desired. A user that is able to manage holds may view all files or folders that have a given named “hold” placed on them via an Administration interface. A user that is able to manage holds is able to assign a named hold on a given file (or folder) either as themselves (default) or as a group that they are a member of (both of these as determined by Active Directory), that they can see on a locked-down network drive via an add-in for Windows File Explorer (or equivalent navigation method). This assignment is recorded in the In-Place database for the given file or folder (including all files in this folder). Upon completing the “hold”, the file or folder (including all files in the folder) will automatically be marked as “locked” in the In-Place database for that given file. A “locked” file cannot be “checked-out”. A reviewable audit will exist that can be used to verify the current state of any file in the In-Place database (i.e., which are currently under “hold”—as well as an audit history of any “holds” that were placed-by whom and when). A user that is able to manage holds is able to remove a “hold” on a given file or folder (including all files in the folder) that is in a “locked” state in the In-Place database via an add-in for Windows File Explorer (or equivalent navigation method). When a user that is able to manage holds removes a “hold” on a file or folder (including all files in the folder), the “locked” state on the file(s) is removed in the In-Place database. An automated process will automatically remove “hold” locks on files in the In-Place database, once the “review date” has expired. An audit of this event will also be recorded in the In-Place database (for the given files). According to the disclosure, a snapshot of holds may include the following:

According to this disclosure an In-Place Content Management system has multiple differences with existing enterprise content management (ECM) systems. For OpenText Content Server, all of the desired documents would have to be migrated into Content Server first, which could take months or years, depending on the amount of data (with Shinydocs In-Place Content Management, no migration is required as the documents are managed where they are). Content Server is also known to have a hard upper limit of around 300 TB (about 300 million documents), so attempting to manage more data that that may not be possible (with Shinydocs In-Place Content Management, there is no upper limit). Lastly Content Server has an unfriendly UI which has hampered its adoption in organizations where it is deployed (Shinydocs In-Place Content Management uses the familiar existing Windows File Explorer interface, so users do not need to change the way they work).

For Microsoft Sharepoint Online (Office 365), all of the desired documents would have to be migrated into SharePoint Online first, which could take months or years, depending on the amount of data (with Shinydocs In-Place Content Management, no migration is required as the documents are managed where they are). Since SharePoint Online is a cloud service, it is expected to be slower than on-premises In addition, being a cloud service may be a security concern for some organizations (Shinydocs In-Place Content Management uses existing file share on-premises infrastructure which will be faster than cloud and will already has enterprise level security in place).

With IBM FileNet, all of the desired documents would have to be migrated into FileNet first, which could take months or years, depending on the amount of data (with Shinydocs In-Place Content Management, no migration is required as the documents are managed where they are). As FileNet is older technology, there is likely a hard upper limit on the amount of data it can hold, but that limit is unknown (so attempting to manage more data that that may not be possible—with Shinydocs In-Place Content Management, there is no upper limit). FileNet has a very difficult to learn UI, which has hampered adoption in organizations where it is deployed (Shinydocs In-Place Content Management uses the familiar existing Windows File Explorer interface, so users do not need to change the way they work).

M-Files is a “layer” that sits on top of all connected repositories (presenting a new interface for navigating to documents). The main difference with this product is that it changes the way an end-user has to access files, which would certainly hamper adoption in organizations (Shinydocs In-Place Content Management uses the familiar existing Windows File Explorer interface, so users do not need to change the way they work). M-Files is also mainly a cloud service, which may be a security concern for some organizations (Shinydocs In-Place Content Management uses existing file share on-premises infrastructure which will be faster than cloud and will already has enterprise level security in place).

According to further embodiments, for implementing an end-user experience where users can check-out or check-in files, one may adapt a Windows File System add-in. If files were checked-out, the info could be stored in a table. An automated process would check this table every few seconds (e.g., a small SQLite database). If a check-out (or check-in) was requested, an automated process to run such as “SetFileSystemPermissions” to change permissions on the file(s) in question would have to be run before the end-user could do anything. A similar strategy for rename, move, delete, add classification, add hold, and add disposition could be implemented.

40 According to further embodiments, the In-Place Content Management System may implement a Malware Detection Module on the server, as part of the Content Management System, which tracks Check Out and Check In requests for files, and monitors for activity which may be indicative of malware on the client computer, or malicious intent on the part of the user. If this module detects unusual Check Out activity, it may cause the File Explorer plug-in on the respective client (which is requesting the Check Outs) to take an appropriate action, such as one or more of displaying a message indicating the files being checked out or displaying a message indicating that malware may be present. In addition, the module, upon detecting such activity, may take one or more of the following actions: log the condition in the system log, notify the system administrator of the situation, delay taking action on any Check Out requests from the client, bar the client from accessing the system entirely, notify other CMS servers of the situation, or take another action in response to the perceived situation.

counting of Check Out requests from a client within a period of time, with such a count increasing over a given threshold; logging which files are typically checked out by each client and noting a significant departure from typical usage; heuristically determining that the checkout behaviour of a client is abnormal; using an artificial intelligence system to detect probable malware behaviour; any other system of detecting malware-related requests from a client. The Malware Detection Module may detect potential malware on a client computer through one or more of the following:

According to the disclosure, a computer-implemented method for controlling access to files in a file system as would be implemented in an enterprise content management (ECM) system, using an in-place content management system is disclosed. The method comprises the steps of scanning the file system, making a shadow copy of existing permissions on all files and folders in the file system, loading the folder structure into a database so there is a record of the structure and the metadata associated with all files and folders and changing the file system permissions wherein all permission except read-access is removed from all files and folders in the file system. According to the method, accessing permissions at the user level are not changed. Furthermore, users gain access to files and folders via a Windows File Explorer add-in and the method utilizes New Technology File System (NTFS) permissions.

According to the disclosure, the files in the method further comprising data and documents. The users of the method who had the ability to read the file or folder previously still has this ability and users that did not have any read access previously continue to not have this access.

According to the disclosure, the Windows File Explorer add-in of the method enables the ability to check-out documents, temporarily restricting document edit access to a single user, check-in the same documents, and restore edit access once the user is done with the file. The method further comprises editing a document once it has been checked-out by double-clicking on the document to open it in its associated editing tool.

According to the disclosure, the method further comprises access to other file system actions, the other file system actions selected from a list consisting of add file, rename file, move file, and delete file. The other file system actions only remain valid for the user possessing the requisite permissions, as confirmed by checking the “shadow copy” permissions, before the permissions were removed.

According to the disclosure, the actions that are taken of the method are audited and stored in a database that is administered by a central Internet Information Services (IIS) server. The authorized end-users of the method are configured to assign a Classification value to a document, assign a Hold to a document, and assign a Disposition value to a document.

According to the disclosure, an in-place content management system configured to support enterprise content management (ECM) system functionality with data residing on a New Technology File System (NTFS) is disclosed. The system comprises memory, a network interface, a processor coupled to the memory and the network interface. The processor is configured to execute a file manager stored in the memory, the file manager for receiving user file commands and outputting user file information, a file system, accessible via network, being the location where the files are stored and accessed, an active directory for managing permission access to the features of the in-place content management application, and for implementation of specific in-place content management permissions, and one or more database to be configured and used for the storage of content management attributes associated with files accessed via the in-place content management system.

According to the disclosure, the system further comprises an in-place content management module stored in the memory, the in-place content management system interface configured to receive user file commands from the file manager and translate the user file commands into content management commands for sending to the remote content management system via the network interface, the content management system interface further configured to receive remote file information from the remote content management system via the network interface and translate the remote file information into user file information for the file manager. The in-place content management module is configured to support summaries, audit, versions, dispositions and permissions.

According to the disclosure, the summaries of the system further comprising summaries for metadata, categories, attributes and insights. The system further comprises supporting a plurality of features selected form a list consisting of check-out, check-in, security, audit, add, rename, move, delete, classification, legal holds and disposition. The system leverages existing security that is already in place on files and folders to support content management actions.

According to the disclosure, the content management actions of the system is selected from a list consisting of check-out, check-in, audit history, add classifications, trigger dispositions, and apply legal holds on documents where they reside. The check-out and check-in content management actions of the system is configured to prevent multiple users from editing the same document at the same time.

According to the disclosure, users gain access to files and folders of the system via a Windows File Explorer add-in. The Windows File Explorer add-in enables the ability to check-out documents, temporarily restricting document edit access to a single user, check-in the same documents, and restore edit access once the user is done with the file.

According to the disclosure, the system further comprises access to other file system actions, the other file system actions selected from a list consisting of add file, rename file, move file, and delete file. The other file system actions only remain valid for the user possessing the requisite permissions, as confirmed by checking the “shadow copy” permissions, before the permissions were removed. The authorized users of the system are configured to assign a Classification value to a document, assign a Hold to a document, and assign a Disposition value to a document.

Numerous advantages of the present invention should be apparent from the above. In addition to a familiar and intuitive interface being provided for remote content management system, network traffic can be reduced by the handling of temporary files. Migration from legacy storage to modern content management systems is also facilitated in a transparent and efficient manner. Other advantages should also be apparent to those skilled in the art.

While the foregoing provides certain non-limiting example embodiments, it should be understood that combinations, subsets, and variations of the foregoing are contemplated. The monopoly sought is defined by the claims.

The functions described herein may be stored as one or more instructions on a processor-readable or computer-readable medium. The term “computer-readable medium” refers to any available medium that can be accessed by a computer or processor. By way of example, and not limitation, such a medium may comprise RAM, ROM, EEPROM, flash memory, CD-ROM or other optical disk storage, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store desired program code in the form of instructions or data structures and that can be accessed by a computer. It should be noted that a computer-readable medium may be tangible and non-transitory. As used herein, the term “code” may refer to software, instructions, code or data that is/are executable by a computing device or processor. A “module” can be considered as a processor executing computer-readable code.

A processor as described herein can be a general-purpose processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic device, discrete gate or transistor logic, discrete hardware components, or any combination thereof designed to perform the functions described herein. A general-purpose processor can be a microprocessor, but in the alternative, the processor can be a controller, or microcontroller, combinations of the same, or the like. A processor can also be implemented as a combination of computing devices, e.g., a combination of a DSP and a microprocessor, a plurality of microprocessors, one or more microprocessors in conjunction with a DSP core, or any other such configuration. Although described herein primarily with respect to digital technology, a processor may also include primarily analog components. For example, any of the signal processing algorithms described herein may be implemented in analog circuitry. In some embodiments, a processor can be a graphics processing unit (GPU). The parallel processing capabilities of GPUs can reduce the amount of time for training and using neural networks (and other machine learning models) compared to central processing units (CPUs). In some embodiments, a processor can be an ASIC including dedicated machine learning circuitry custom-build for one or both of model training and model inference.

The disclosed or illustrated tasks can be distributed across multiple processors or computing devices of a computer system, including computing devices that are geographically distributed. The methods disclosed herein comprise one or more steps or actions for achieving the described method. The method steps and/or actions may be interchanged with one another without departing from the scope of the claims. In other words, unless a specific order of steps or actions is required for proper operation of the method that is being described, the order and/or use of specific steps and/or actions may be modified without departing from the scope of the claims.

As used herein, the term “plurality” denotes two or more. For example, a plurality of components indicates two or more components. The term “determining” encompasses a wide variety of actions and, therefore, “determining” can include calculating, computing, processing, deriving, investigating, looking up (e.g., looking up in a table, a database or another data structure), ascertaining and the like. Also, “determining” can include receiving (e.g., receiving information), accessing (e.g., accessing data in a memory) and the like. Also, “determining” can include resolving, selecting, choosing, establishing and the like.

The phrase “based on” does not mean “based only on,” unless expressly specified otherwise. In other words, the phrase “based on” describes both “based only on” and “based at least on.” While the foregoing written description of the system enables one of ordinary skill to make and use what is considered presently to be the best mode thereof, those of ordinary skill will understand and appreciate the existence of variations, combinations, and equivalents of the specific embodiment, method, and examples herein. The system should therefore not be limited by the above-described embodiment, method, and examples, but by all embodiments and methods within the scope and spirit of the system. Thus, the present disclosure is not intended to be limited to the implementations shown herein but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.